Basic Information Security Policy Template

[Company Name] – Information Security Policy

Contents

1. Purpose	3

2. Scope	3

3. Information Security Objectives	3

Employees & Contractors	3

Management	3

IT / Security Team	3

5. Access Control	3

6. Acceptable Use	4

7. Device & System Security	4

8. Data Protection & Handling	4

9. Email & Communication Security	4

10. Physical Security	4

11. Third Parties & Suppliers	5

12. Backup & Recovery	5

13. Incident Reporting	5

14. Monitoring & Logging	5

15. Policy Compliance	5

16. Policy Review	5

17. Approval	5

18. Acknowledgement	6

1. Purpose

The purpose of this policy is to define how [Company Name] protects its information, systems, and services from security threats. This policy establishes the minimum security expectations for all employees, contractors, and third-party partners.

2. Scope

This policy applies to:

All employees, contractors, temporary staff, and third parties

All company-owned or managed devices, systems, and networks

All data created, stored, processed, or transmitted by [Company Name]

3. Information Security Objectives

[Company Name] aims to:

Protect the confidentiality, integrity, and availability of information

Reduce the risk of unauthorised access, misuse, or data loss

Ensure secure operation of systems, services, and business processes

Meet legal, regulatory, and contractual obligations

Promote a culture of security awareness across the organisation

4. Roles & Responsibilities

Employees & Contractors

Follow all security policies and procedures

Report suspicious activity or incidents immediately

Protect company devices and credentials

Management

Ensure teams comply with this policy

Provide resources for effective security implementation

IT / Security Team

Maintain secure systems and controls

Manage access rights and authentication

Monitor networks and respond to incidents

Apply updates, patches, and configuration standards

5. Access Control

Access is granted based on job role (least privilege)

Multi-factor authentication (MFA) must be used where available

Shared accounts are prohibited

Access for leavers must be removed immediately

Passwords must follow strong complexity and length requirements

6. Acceptable Use

Users must:

Use company systems only for authorised business activities

Avoid installing unauthorised software

Not bypass or disable security controls

Ensure company data is not stored on personal devices unless approved

Follow safe practices when browsing, emailing, or downloading content

7. Device & System Security

All company devices must be protected with encryption

Anti-malware protection must be enabled and updated

Devices must lock automatically when unattended

Operating systems and applications must be kept up to date

USB storage devices must be approved before use

8. Data Protection & Handling

Confidential data must only be accessed by authorised personnel

Sensitive information must be encrypted in transit and at rest

Data must not be shared externally without authorisation

Records must be retained and disposed of according to company guidelines

9. Email & Communication Security

Be cautious when opening attachments or clicking links

Verify unexpected requests, especially financial or access-related

External email forwarding is prohibited

Company information must not be sent to personal accounts

10. Physical Security

Visitors must be signed in and escorted

Sensitive areas require controlled access

Devices must not be left unattended in public spaces

Tailgating must be challenged politely and consistently

11. Third Parties & Suppliers

Third-party access requires documented approval

Vendors must follow appropriate security controls

Contracts must include confidentiality and data protection clauses

External services must be reviewed for risk before use

12. Backup & Recovery

Critical data must be backed up regularly

Backups must be encrypted and tested periodically

Users must not store important files solely on local drives

13. Incident Reporting

All suspected security incidents must be reported immediately to:

[Security Contact / IT Helpdesk]

[Incident Response Team / Email Address]

Do not attempt to investigate or fix the issue yourself unless instructed.

14. Monitoring & Logging

System activity may be monitored for security and compliance

Logs must be retained in accordance with company requirements

15. Policy Compliance

Violations of this policy may lead to:

Disciplinary action

Revocation of access rights

Termination of employment (in serious cases)

Legal action, where applicable

16. Policy Review

This policy must be reviewed at least annually, or sooner if:

Significant changes occur within the organisation

New regulations or risks arise

Major incidents highlight gaps or updates

17. Approval

Approved by: __________________________
Role: _________________________________
Date: _________________________________

18. Acknowledgement

I confirm that I have read, understand, and agree to follow this policy.

Name: _________________________________
Signature: _____________________________
Date: _________________________________